What is the CVSS score of CVE-2026-6675?

CVE-2026-6675 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-6675

EUVD-2026-24058 MEDIUM

Improper Input Validation (CWE-20)

2026-04-21 Wordfence

Information Disclosure WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 02:55 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 02:45 euvd

EUVD-2026-24058

Analysis Generated

Apr 21, 2026 - 02:45 vuln.today

CVE Published

Apr 21, 2026 - 02:25 nvd

MEDIUM 5.3

DescriptionCVE.org

The Responsive Blocks - Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to Unauthenticated Open Email Relay in all versions up to, and including, 2.2.0. This is due to insufficient authorization checks and missing server-side validation of the recipient email address supplied via a public REST API route. This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient of their choosing through the affected WordPress site's mail server, effectively turning the site into an open mail relay.

AnalysisAI

Unauthenticated open email relay in Responsive Blocks - Page Builder for Blocks & Patterns WordPress plugin (versions up to 2.2.0) allows remote attackers to send arbitrary emails through the affected site's mail server via a public REST API endpoint lacking authorization checks and email recipient validation. The vulnerability enables attackers to abuse WordPress sites for spam distribution and phishing campaigns without authentication.

Technical ContextAI

The Responsive Blocks plugin exposes REST API routes that interact with WordPress's mail functionality without proper authorization checks (CWE-20: Improper Input Validation). The vulnerable code paths, visible in the plugin's class-responsive-block-editor-addons.php file (lines 2212, 2324, and 2403), process email recipient addresses supplied by unauthenticated requests without validating the input or verifying caller permissions. This allows the plugin to pass arbitrary recipient addresses directly to WordPress's mail server, transforming the site into an open relay. The vulnerability affects all installations running version 2.2.0 and earlier, regardless of WordPress hardening or security plugins, because the flaw exists at the plugin code level before any mail sending is triggered.

RemediationAI

Update Responsive Blocks plugin to version 2.2.1 or later immediately. Because the vulnerability is unauthenticated and public-facing, any WordPress site running versions up to 2.2.0 is at risk regardless of other security measures. For sites unable to update immediately, the primary compensating control is to disable the affected REST API endpoints by adding a must-use plugin (MU-plugin) that blocks requests to the vulnerable routes-specifically, routes matching the email sending endpoints in responsive-block-editor-addons.php. Add the following filter to mu-plugins/block-rest-disable.php: add_filter( 'rest_endpoints', function( $endpoints ) { unset( $endpoints['/responsive-block-editor-addons/v1/send_email'] ); return $endpoints; }, 10, 1 ); This prevents exploitation while maintaining other plugin functionality, but does not address the root cause; patching is the definitive fix. Alternatively, restrict REST API access at the web server level (nginx/Apache) to authenticated requests only, though this may break other legitimate REST integrations. Consult Wordfence's advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/17452a29-bcef-451a-9893-a436ac5d3b80 for the latest patch details and configuration guidance.